Elasticsearch - Track new Geolocation an IP shows up in

[Elk_huh (Brian)]

What function in Elasticsearch / kibana can we use to track if any IP shows up in a new GEOlocation

Or a new IP Address shows up that isnt already there

[Tortoise]

Hello @Elk_huh

I came across this post where found below suggestion which can be useful :

Map IP Address to geolocation and use of the anomaly detector

Hi @Vannessa_Kemeni Elasticsearch includes a GeoIP processor that can be used when ingesting data to get the GeoLocation for an IP address. Read more about GeoIP Processor For machine learning, I will direct you to the Machine Learning Getting Started documentation. That should walk you through building your first machine learning job and you should be able to adapt that to your use case.

Thanks!!